---
title: "Refresh access token"
method: POST
path: "/v1/auth/refresh"
tags: ["Auth"]
---

# Refresh access token

`POST /v1/auth/refresh`

## Request

- Base URL: `http://localhost:4000`
- URL: `http://localhost:4000/v1/auth/refresh`
- Auth: none declared

Rotate the refresh token and issue a new access token. The old refresh token is invalidated (single-use rotation).

## Request body

- RefreshTokenRequest
  - `refreshToken` string, required

## Response `200`

New tokens

- AuthTokenResponse
  - `accessToken` string: JWT access token (15min expiry)
  - `refreshToken` string, nullable: Refresh token (30 day expiry, single-use). Null when resuming an existing device session — keep the stored token.
  - `expiresIn` integer: Access token TTL in seconds
  - `tokenType` string
  - `device` object
    - `id` string, uuid
    - `deviceFingerprint` string
    - `createdAt` string, date-time

## Other responses

- `401`: Invalid or expired refresh token

---

[API](https://skmtc.dev/reqistry/apis/public-apis-mobile-client-api.md) · [All operations](https://skmtc.dev/reqistry/apis/public-apis-mobile-client-api/llms.txt) · [OpenAPI document](https://skmtc.dev/reqistry/apis/public-apis-mobile-client-api/revisions/7f07b9ca718f?raw)